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STATINT did 
: 99 JUL 1980 


MEMORANDUM FOR: Chief, Regulations Control Division, ISS 


——— 
STATINTL Chief, Managenert Staff, ODP 


SUBJECT : Proposed Revision of ur BE) automatic 
Data Processing (ADP) Management (Job 
#8345) Draft = 


REFERENCE : Your Memo, dtd. 16 July 1980, Same Subject 


STATINTL 


l. Please find attached Draft © of proposed = 
We have included those ravisions we find acceptable from 
the comments received on Draft 9, the reference. Also 
attached are our reasons for acgaptance or rejection and 
a summary of the actions taken referenced to the draft 
paragraphs. 


Rg 


‘Any action you can take to put this regulation 


 4n the. record would be appreciated. It has been over three 
years since we started. 


STATINTL \s | 


Attachments: a/s 
ODP /MS/RFF:jal/ (5937) (25duly1980) 


DISTRIBUTION: 
Original and 1 - Addressee 
(2-- 0/D/ODP (-.dhaT7 
1 - MS Chrono ;-,.G/ATT7 
2 - ODP Registry J/,olATT 
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MANAGEMENT 
STATINTL HR a 
n 15s AUTOMATIC DATA PROCESSING MANAGEMENT 

SYNOPSIS. This regulation prescribes ADP 

{automatic data processing) management policy 

and responsiblities. Definitions of major 

ADP categories are included for common re- 

ference. 

a. GENERAL 

(1) Public Law 89-306 dated 30 October 1965, 
40 U.S.C. 759, is the basic law from which all policies, 
regulations, and guidelines for Government-wide ADP pro- 
curement and management are derived. The intent of the law 
is to provide for the economical and efficient purchase, 
lease, maintenance, operation, and utilization of automatic 
data processing equipment by Federal departments and agencies. 
Central to administering the law within Federal departments 
and agencies are long range ADP planning, adequate justifi- 
cation of ADP resources, review of utilization, and competi- 
tive procurements for ADP equipment, software, and services. 

(2) This regulation does not apply to the ADP 
systems or networks that are used exclusively for telecom- 
munications service. Such systems or networks are controlled 


by pertinent national policies and regulations. 
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b. DEFINITIONS 

(1) ''Automatic data processing equipment (ADPE)'' 
means general purpose, commercially available, and mass- 
produced automatic data processing components and the hard- 
ware systems built from them regardless of size, capacity, 
or price that are designed to be applied to the solution or 
processing of a variety of problems or applications. ADPE 
does not include equipment specially designed, as opposed — 
to configured, for a specific application that precludes 
future use of the equipment for the solution of a variety 
of problems or the processing of other applications. 

(2) '’Automatic data processing (ADP)'' includes 
those activities that are inseparable from the operations 
of ADPE. Examples are ADP systems analysis and design, 
programming, ADP training, and maintenance of ADPE. 

(3) ‘'ADP personnel'' are those individuals con- 
nected with ADP or ADP-related support functions (e.g., ADP 
management officials and systems development, applications 
development, and operations personnel). Included are per- 
sonnel from ADP user organizations principally assigned to 
ADP support functions in the user organization. However, 
personnel who simply use ADP incidental to the performance 


of their primary function are not considered ADP personnel. 
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(4) ''software'' ancompasses all programs and 
routines such as compilers, assemblers, utilities, subroutines, 
and data base management systems used on ADPE. 

(5) ‘'tADP resources'' include ADPE, ADP personnel, 
software, and data communications necessary for the utiliza- 
tion of ADPE. 

c. POLICY 

It is Agency policy to manage and administer its 
ADP activities in a cost-effective manner that is SoasnciiGs 
to Agency needs and adheres to all applicable Federal laws, 
regulations, and guidelines. 

d. RESPONSIBILITIES 

(1) The Executive Committee is responsible for: 

(a) Approving ADP projects, whether supported 

by ODP or with component-budgeted resources, in 

which the ADP resources will exceed $250,000 in 

annual or cumulative costs. 

(b) Reviewing major ADP capital investments in- 

cluded in the Agency's Program Plan before sub- 

mission to the Resource Management Staff each 
year. 

(c) Establishing strategic objectives for the 

Agency's use of ADP and tracking progress toward 


achieving them. 
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Offices 


(2) Deputy Directors and Heads of Independent 


are responsible for: 


(a) Ensuring that proposed acquisitions of 

ADP resources are justified as necessary to 
carry on essential activities and that pro- 
curement of these resources will be competitive 
to the maximum extent practicable. 

(b) Ensuring that proposed ADP applications 
are reviewed for compliance with the Privacy 
Act (5 U.S.C. 552a) and Executive order con- 
straints with respect to storage and retriev- 
al of information concerning U.S. persons 

and, if necessary, coordinating with the Office 
of General Counsel and other offices as appro- 
priate before approving the application. 

(c) Advising the Director of Data Processing 
promptly of new ADP support requirements so 
they can be evaluated and included in the plans 
ae programs of the Office of Data Processing. 
(d) Coordinating with ODP any plan or pro- 
posal that would establish ADP functions such 
as systems analysis, software development, 
computer operations, or ADP training in other 


components. 
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(e) Submitting requirements and costs for ADP 

resources in annual budgets and assisting ODP 
2 in the preparation of ODP-supported project 

reports for the Executive Committee review. 

(f) Obtaining ODP concurrence in plans and 

proposals for ADPE, software, or contract ser- 

vices that involve any of the following: 

(1) Procurement of ADPE that includes a CPU 

(central processing unit) regardless of cost. 

(2) Upgrading or expansion of installed ADPE 

when the additional annual rental cost is 

$50,000 or more or when the additional pur- 

chase cost is $150,000 or more. 

(3) Procurement ot ADP system design, pro- 

gramming, or other services (excluding equip- 

ment maintenance) when the annual cost is 

$50,000 or more. 

(g) Consulting with the Office of Logistics 

on any planned ADP procurement, regardless 

of dollar value, prior to initiating discussions 


with potential suppliers. 
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(h) Reviewing ADP service charges as reported 
by ODP to determine the cost effectiveness of 
ADP projects and annually revalidating ADP ser- 
vice requirements. 

(i) Reporting to ODP information on ADPE and 
ADPE personnel for inclusion in the Agency's 

ADP Management Information System. 

(4) Appointing an officer to act as the 
Directorate or Independent Office ADP Control 
Officer, and directing the appointment of com- 
ponent ADP Control Officers as appropriate. 

(3) The Comptroller is responsible for: 

(a) Approving increases in projected costs 

for Executive Committee-approved, ODP-supported 
ADP projects which exceed the initial authoriza- 
tion by more than i0 percent, and for component-— 
budgeted ADP projects which exceed the intitial 
authorizations beyond the reprogramming authority 
of the Deputy Directors. 

(b) Advising ODP of ADPE, software, or ADP 
services acquisitions projected in Agency com- 


ponent budget submissions. 
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(4) Directorate, Independent Office, and compo- 
nent ADP Control Officers are responsible for administering 
ADP matters within their area including: 

(a) Reviewing ADP service or procurement requests 

before these requests are submitted to ODP. 

(b) Reviewing and tracking ODP Project Resource 

Information System (PRISM) accounting reports. 

(c) Initiating PRISM project records for new 

ADP activities and changing existing PRISM pro- 

ject records when applicable. 

(da) Verifying ADP user names and distributing 

ODP user passwords. 

(e) Reporting and coordinating resolution of 

ADP security breaches with the ODP Security 

Officer. 

(f£) Ensuring that all component ADP systems 

are in compliance with existing security regu- 

lations and procedures. 

(g) Validating terminal requests, and user 

access requests. 

(h) Ensuring that ADP users are trained to 

use ODP services and are aware of all applica- 


ble security regulations and procedures. 
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sible for: 


(i) Informing OPP of surplus ADPE for possi- 
ble reutilization in other Agency components. 


(5) The Director of Data Processing is respon- 


(a) Providing a central computer service to 
satisfy ADP requests from any Agency component 
and to satisfy intelligence community require- 
ments as assigned. 

(b) Reviewing plans including initial systems 
and revalidation studies and concurring in formal 
Proposals by Agency components for procurement 

of ADPE, software, or contract services that meet 
the criteria described in paragraph d(2) (f) above 
before procurement action is taken. 

(c) Formulating and promulgating policies and 
guidelines relative to the Justification, use, 
and management of ADPE, software, and services. 
(da) Reporting annually to the Executive Committee 
on the state of ODP, its ability to satisfy cur- 
rent year requirements for ADP support, and its 


long term plans. 
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(e) Maintaining a current copy of all Federal 
Information Processing Standards (FIPS), coor- 
dinating Agency comments on proposed FIPS, and 
promulgating Agency guidelines in the use of 
FIPS. 
(f) Maintaining a detailed inventory of Agency 
ADPE and a summary of the Agency's total ADP 
skills and ADP costs. 
(g) Maintaining a system to account for the use 
of ODP ADP resources by user components. 
(h) Developing and conducting ADP training 
programs on ODP computer systems and services 
to meet Agency requirements. 
(i) Assignment of user identification and pass- 
words. 
(6) The Office of Security is responsible for 
developing security policy for ADP systems and for advising 
and coordinating with other Agency components in the estab- 
lishment of security standards and procedures for Agency 
ADP facilities and activities. 

(7) The Office of Communications is responsible 
for the provision of all communications support necessary 
between and among decentralized ADPE, and for the estab- 


lishment, execution, and enforcement of communications 
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security (COMSEC) policies end Programs for the Agency 
ADP systems and networks. 

: (8) The Office of Logistics is responsible for 
procuring ADPE, software, services, and Supplies, except 
as otherwise specifically delegated by the DCI, and issuing 
guidelines on ADP procurement. The Office of Logistics is 
responsible for providing the utilities ana computer room 


facilities required by ADPE. 
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SUMMARY 


Suggester/Component 
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OS/ODP 
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Comment 


New paragraph 


New paragraph 


Add new d. (5) (i) 


Not necessary 
(See D(5) (i)) 


Not necessary 
(Redesignation) 


New 
New 


New paragraph 
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The comments received from OGC, OL, OS and NFAC are 
listed below in the order of the organization of the paper. 
Each comment is not reproduced; only the reason for accep- 
tance or rejection is given. 

a. (1) Accept the inclusion of the U.S.C. 

citation from OGC for precision. 

a. (1) Reject the suggestion from OL. The 
authority of GSA over the Agency with 
regard to the delegation of procure- 
ment authority is not central to the 
Agency management of ADPE. The original 
section was removed at the request of 
the Inspector General as a part of an 
effort to clarify Agency regulations. 

In view of the 1947 Act and the author- 
ities given the DCI, citation of GSA 
authority is not necessary. This reason 
also applies to all of OL's comments 
concerning CFR. 

a. (2) Reject OL suggestion-same as a.(l). 

b. (1) Reject OL suggestion. We believe this 
is an unnecessary elaboration for the 
purposes of this regulation. The pre- 


sent wording is a definition approved 
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b. (3) 

b. (5) 

d. (2) (a) 

d. (2) (b) 

d. (2) (£) (3) 
d. (2) (£) (4) 


by the EXCOM, and does not contradict 

any definition used by GSA or other 

such bodies. 

Reject OL suggestion. This definition 
is for ODP accounting purposes. Comment 
misses the reasons for definition. 

Reject OL suggestion. Comment does not 
take into account purpose of definition‘ 
in conjunction with ODP responsibilities. 
Reject OL suggestion. This is a Deputy 
Director responsibility, and we do not 
believe they need this level of detail 
to manage. 

Accept OGC suggested citation of U. S. 
Code for clarity. 

Accept NFAC suggestion of dollar figure 
of $50,000 as a current reasonable thres- 
hold. 

Reject new paragraph suggested by OL. 


ODP does not review maintenance costs, 
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d. (2) (£) (5) 
d. (3) (b) 
d (4) (d) 
d. (4) (h) 
d. (4) (i) 
d. (4) (3) 
d. (5) (b) 
d(5) (i) 
d. (5) (3) 


d. (5) (i) 


Reject new paragraph suggested by OL. 

ODP does not review this level of soft- 
ware. 

Reject OL suggestion, OL does not have 
this responsibility or function. 

Reject OS suggestion as too detailed. 
Will be covered in new pargraph d. (5) (i). 
Accept OS suggestion, but added to para- 
graph d. (4) (g). 

Reject OS suggestion. Not necessary, in 
view of d(4) (k). 

Same as d. (4) (i). 

Accept OL suggestion. Reasonable, adds to 
understanding. 

Reject OL suggestion for a new paragraph. 
Remote terminal equipment is part of 
central computer service. Remote isa 
"how", not a "what". 

Reject OL suggestion for a new paragraph. 
The suggestion is not an ODP function for 
the Agency. It is a component responsibility. 
New paragraph, partially suggested by OS. 


Paragraph reads “Assignment of user 


identification and passwords." 
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